Deploy testnets from GHA

[gpmayorga]

Summary

Adds automated testnet deployment workflow and fixes critical deployment script issues.

Key Changes

🚀 New CI/CD Workflow

• New workflow: .github/workflows/deploy_testnet.yml for automated testnet deployments
• Manual triggers: Select testnet (sepolia, arbitrum-sepolia, base-sepolia) via workflow dispatch
• PR testing: Auto-deploys to sepolia when workflow file is modified
• Optional PR creation: Can create PRs with env folder changes after deployment

🔐 Security Fixes

• Private key masking: All error output now masks private keys with $PRIVATE_KEY placeholder
• Private key formatting: Fixed newline issues in private keys from Google Secret Manager
• Enhanced error handling: Better error messages and stack traces while maintaining security

Files Changed

• .github/workflows/deploy_testnet.yml (new) - CI/CD workflow
• .github/workflows/deploy-anvil.yml - Renamed from deploy-test.yml
• script/deploy/lib/runner.py - Enhanced error handling
• script/deploy/lib/load_config.py - Fixed private key formatting
• script/deploy/lib/formatter.py - Added CI output flushing

Usage

• Manual: Actions → "Deploy Testnet" → Select network/version
• PR Testing: Modify workflow file to auto-deploy to sepolia to test that it works

[gpmayorga]

Merge #511 FIRST!
Then maybe change the base branch to main and merge this too

[github-actions]

Coverage after merging ci-testnets-deploy into main will be

91.63%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src/common
BaseValuation.sol	100%	100%	100%	100%
GasService.sol	80%	50%	100%	97.65%	100, 102, 104, 106, 108, 110, 112, 114, 116, 118, 121, 123, 125, 128, 130, 132, 134, 136, 138, 140, 143, 86, 88, 90, 92, 94, 96, 98
Gateway.sol	100%	100%	100%	100%
Guardian.sol	90.12%	64.29%	100%	93.88%	152, 152–153, 50–54
MessageDispatcher.sol	97.40%	92.59%	100%	99.12%	64–68
MessageProcessor.sol	95.27%	91.07%	100%	97.70%	182, 51–55, 69
PoolEscrow.sol	100%	100%	100%	100%
Root.sol	100%	100%	100%	100%
TokenRecoverer.sol	100%	100%	100%	100%
src/common/adapters
AxelarAdapter.sol	90.91%	83.33%	100%	92.59%	45–46, 55–56
MultiAdapter.sol	100%	100%	100%	100%
WormholeAdapter.sol	100%	100%	100%	100%
src/common/factories
PoolEscrowFactory.sol	100%	100%	100%	100%
src/common/libraries
MessageLib.sol	90.36%	64.18%	100%	100%	119, 175, 192, 213, 237, 254, 277, 318, 348, 374, 400, 426, 455, 479, 505, 533, 559, 588, 614, 642, 667, 712, 743, 767
MessageProofLib.sol	88.89%	50%	100%	100%	14
PricingLib.sol	100%	100%	100%	100%
RequestCallbackMessageLib.sol	88.64%	50%	100%	100%	106, 141, 38, 57, 77
RequestMessageLib.sol	88.89%	50%	100%	100%	37, 55, 72, 89
src/hooks
FreelyTransferable.sol	0%	0%	0%	0%	103–104, 106, 106, 106–109, 109, 109–112, 112, 112–115, 117, 122–123, 123, 123–124, 124, 124, 126–127, 129, 133–135, 137, 141–142, 146–147, 147, 147–148, 148, 148, 150–152, 154, 158–160, 168–169, 38–39, 47, 52, 52, 52–53, 57, 64, 68, 73–74, 74, 76, 79–80, 80, 82, 85, 85, 87, 90, 90, 92, 95
FreezeOnly.sol	5%	0%	11.11%	5.13%	101, 106–107, 107, 107–108, 108, 108, 110–111, 113, 117–119, 121, 125–126, 134–135, 44, 49, 49, 49–50, 54, 61, 65, 70–71, 71, 73, 76–77, 77, 79, 82, 90–91, 93, 93, 93–96, 96, 96–99
FullRestrictions.sol	97.67%	90%	100%	100%	122, 146
RedemptionRestrictions.sol	51.72%	25%	63.64%	58.93%	106, 109, 109, 109–112, 112, 112–115, 117, 122–123, 123, 123–124, 124, 124, 126–127, 129, 133–135, 137, 141, 146–148, 52, 74, 76, 80, 82, 85, 87
src/hooks/libraries
UpdateRestrictionMessageLib.sol	89.29%	50%	100%	100%	40, 61, 82
src/hub
Accounting.sol	93.75%	96%	100%	91.53%	114–115, 118–119, 134, 137
Holdings.sol	97.46%	88%	100%	100%	116, 222, 82
Hub.sol	85.27%	44.68%	100%	90.50%	110, 290, 429–430, 433, 433–434, 452, 455, 455–456, 476, 493, 510, 537, 541, 571–572, 572, 572–573, 573, 573, 578, 583, 601, 611, 621, 621, 621, 623, 637, 644–646, 736, 79–80, 80–81, 81–82, 82–83, 83–85
HubHelpers.sol	88.46%	87.50%	90%	88.54%	155–157, 163–165, 215, 239, 244–247, 54–55
HubRegistry.sol	93.51%	79.17%	100%	100%	104, 110, 116, 33, 44
ShareClassManager.sol	100%	100%	100%	100%
src/managers
MerkleProofManager.sol	79.45%	61.11%	88.89%	84.78%	104, 111, 130–131, 131, 131, 133–134, 136–137, 40–41, 44, 54
OnOfframpManager.sol	90.59%	82.14%	100%	94%	132, 52, 63, 67–68, 78, 84, 87
src/managers/decoders
BaseDecoder.sol	75%	100%	75%	75%	43–44
CircleDecoder.sol	0%	100%	0%	0%	11, 16, 20, 22
VaultDecoder.sol	0%	100%	0%	0%	10, 104, 110, 15–16, 22, 28, 34, 40, 46, 52, 58, 64, 69, 75, 80, 86, 9, 92, 98
src/misc
Auth.sol	100%	100%	100%	100%
ERC20.sol	100%	100%	100%	100%
Escrow.sol	56.25%	33.33%	100%	66.67%	15, 17, 21–22, 22, 22, 24
IdentityValuation.sol	100%	100%	100%	100%
Multicall.sol	83.33%	33.33%	100%	100%	17, 17
Recoverable.sol	100%	100%	100%	100%
ReentrancyProtection.sol	90%	75%	100%	100%	22
src/misc/libraries
ArrayLib.sol	95.83%	75%	100%	100%	26
BitmapLib.sol	100%	100%	100%	100%
BytesLib.sol	90.09%	54.17%	100%	100%	109, 120, 131, 14, 142, 153, 16, 164, 175, 186, 87
CastLib.sol	95.12%	66.67%	100%	100%	31, 7
EIP712Lib.sol	100%	100%	100%	100%
MathLib.sol	92.47%	70.59%	100%	97.06%	33–34, 43, 45, 47, 49, 51
MerkleProofLib.sol	100%	100%	100%	100%
SafeTransferLib.sol	96.97%	92.86%	100%	100%	75
SignatureLib.sol	95.24%	80%	100%	100%	17
StringLib.sol	100%	100%	100%	100%
TransientArrayLib.sol	100%	100%	100%	100%
TransientBytesLib.sol	100%	100%	100%	100%
TransientStorageLib.sol	100%	100%	100%	100%
src/spoke
BalanceSheet.sol	99.45%	96.55%	100%	100%	59
ContractUpdater.sol	100%	100%	100%	100%
ShareToken.sol	93.51%	66.67%	94.12%	98.04%	101, 113, 146, 33
Spoke.sol	90.86%	74%	94.87%	97.42%	124, 124–125, 125, 127, 154, 202, 210, 282, 302, 317, 330, 340–342, 361, 382, 405, 453, 467, 533, 533–534, 534, 534–535, 535, 535, 98, 98–99, 99
src/spoke/factories
TokenFactory.sol	92%	50%	100%	94.74%	23–24
src/spoke/libraries
UpdateContractMessageLib.sol	88.89%	50%	100%	100%	110, 40, 62,